{"repo":"NousResearch/hermes-agent","public_id":"125189","display_label":"Child env credential scrub bypass fixes","summary":"These issues and fixes address a bug where spawn sites that spread os.environ into child process environments inadvertently undo credential scrubbing, exposing adapter secrets and internal secrets to agent children.","subsystem":"agent","counts":{"members":3,"open_issues":1,"open_issues_distinct":1,"open_prs":0,"closed_issues":0,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":125755,"merged_at":"2026-09-28T20:36:59+00:00"},"resolution":{"state":"unresolved","by":null},"freshness":{"state":"verified","last_verified_at":"2026-09-28T20:36:59+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":125189,"pr_number":125755,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-28T20:36:59+00:00"}],"members":[{"kind":"issue","number":125189,"title":"[Bug]: Spawn sites that spread os.environ into a child env undo the credential scrub (compute host, LSP, raft, buzz)","url":null,"state":"open"},{"kind":"pr","number":125191,"title":"fix(child-env): spawn sites that spread os.environ no longer undo the credential scrub","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#125755","number":125755}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":125755,"title":"fix(child-env): keep declared adapter secrets and Hermes' own secrets out of agent children (salvage #122751, #125191)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/lsp/client.py","agent/lsp/install.py","gateway/platform_registry.py","hermes_cli/config.py","hermes_cli/profile_channels.py","plugins/memory/openviking/__init__.py","plugins/platforms/a2a/plugin.yaml","plugins/platforms/buzz/adapter.py","plugins/platforms/photon/plugin.yaml","plugins/platforms/raft/adapter.py","plugins/platforms/teams/plugin.yaml","plugins/platforms/telegram/adapter.py","plugins/platforms/telegram/plugin.yaml","tests/agent/test_subprocess_env_guard.py","tests/tools/test_hermes_subprocess_env.py","tests/tools/test_local_env_blocklist.py","tests/tools/test_modal_snapshot_isolation.py","tests/tools/test_spawn_site_child_env.py","tools/bot_desktop/runtime.py","tools/env_passthrough.py","tools/environments/local.py","tools/environments/local_env_policy.py","website/docs/user-guide/features/lsp.md","website/docs/user-guide/features/memory-providers.md","website/docs/user-guide/messaging/raft.md","website/docs/user-guide/security.md","website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/lsp.md","website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/memory-providers.md","website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/security.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}